46 matches found
Security update for nodejs24
This update for nodejs24 fixes the following issues: Security issues fixed: CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent bsc1286565. CVE-2026-105482: dns.resolve truncates names containing NUL char bsc1286561. CVE-2026-105483: TLS certificate...
Security update for nodejs22
This update for nodejs22 fixes the following issues: CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent bsc1286565. CVE-2026-105482: dns.resolve truncates names containing NUL char bsc1286561. CVE-2026-106069: TLS certificate hostname bypass when th...
SUSE-SU-2026:5036-1 Security update for nodejs22
This update for nodejs22 fixes the following issues: - CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent bsc1286565. - CVE-2026-105482: dns.resolve truncates names containing NUL char bsc1286561. - CVE-2026-106069: TLS certificate hostname bypass...
SUSE-SU-2026:4957-1 Security update for nodejs22
This update for nodejs22 fixes the following issues: - CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent bsc1286565. - CVE-2026-105482: dns.resolve truncates names containing NUL char bsc1286561. - CVE-2026-106069: TLS certificate hostname bypass...
nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()
A flaw was found in the Node.js Permission Model. fs.realpathSync does not perform the filesystem read permission checks required of comparable fs APIs. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.native. Code running under --permission with restricted...
nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()
A flaw was found in the Node.js Permission Model. fs.realpathSync does not perform the filesystem read permission checks required of comparable fs APIs. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.native. Code running under --permission with restricted...
BIT-NODE-MIN-2026-106073
A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.native. As a result, code running under --permission with restricted --allow-fs-read can...
BIT-NODE-2026-106073
A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.native. As a result, code running under --permission with restricted --allow-fs-read can...
CVE-2026-106073
A flaw was found in the Node.js Permission Model. fs.realpathSync does not perform the filesystem read permission checks required of comparable fs APIs. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.native. Code running under --permission with restricted...
Node.js Permission Model realpathSync Read Bypass
Node.js versions 22.x, 24.x, and 26.x contain a Permission Model bypass in fs.realpathSync. This offline Python tool evaluates supplied version evidence against fixed releases 22.23.4, 24.22.1, and 26.12.1...
Important: nodejs22
Issue Overview: A vulnerability in Node.js HTTP Agent handling allows a keep-alive socket to process a response that was written before the corresponding request was sent. This may cause incorrect response association and potentially lead to HTTP response confusion or unintended data exposure...
Important: nodejs24
Issue Overview: A vulnerability in Node.js HTTP Agent handling allows a keep-alive socket to process a response that was written before the corresponding request was sent. This may cause incorrect response association and potentially lead to HTTP response confusion or unintended data exposure...
Node.js Permission Model realpathSync Read Bypass
Node.js versions before 22.23.4, 24.22.1, and 26.12.1 contain a Permission Model bypass in fs.realpathSync that permits restricted code to inspect filesystem paths outside allowed read directories...
ALPINE-CVE-2026-106073
A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.native. As a result, code running under --permission with restricted --allow-fs-read can...
DEBIAN-CVE-2026-106073
A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.native. As a result, code running under --permission with restricted --allow-fs-read can...
CVE-2026-106073
A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.native. As a result, code running under --permission with restricted --allow-fs-read can...
AZL-111032 CVE-2026-106073 affecting package nodejs for versions less than 24.22.1-0
A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.native. As a result, code running under --permission with restricted --allow-fs-read can...
UBUNTU-CVE-2026-106073
A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.native. As a result, code running under --permission with restricted --allow-fs-read can...
CVE-2026-106073
A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.native. As a result, code running under --permission with restricted --allow-fs-read can...
CVE-2026-106073
A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.native. As a result, code running under --permission with restricted --allow-fs-read can...